CVE-2026-0326: PAN-OS: Buffer Overflow Vulnerability in Protocol and Service Processing

Is it exploited?

Not on CISA's list. CISA has not added it to the Known Exploited Vulnerabilities catalog as of 10 Nov 2026. If CISA adds it, this page shows it as known exploited.

How likely is exploitation in the next 30 days?

0.4%

EPSS score, percentile 37.3 of all scored records. A probability estimated by FIRST, not a report of exploitation.

How severe?

1.7 Low

CVSS v4.0 base score, given by the CNA

What should I do?

VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW Customers who prefer to upgrade can work with Palo Alto Networks support to schedule an on-demand software upgrade. Full textSolution from the CVE record.

CISA has set no required action, because the vulnerability is not in KEV.

Advisories and patches (1)

Which versions are affected?

Affected

• All
• from 12.2.0 to before 12.2.4-h2
• from 12.1.0 to before 12.1.10-h4
• from 11.2.0 to before 11.2.16-h2
• from 11.1.0 to before 11.1.16-h5

Unaffected from 12.2.4-h2; from 12.1.10-h4; from 11.2.16-h2; from 11.1.16-h5; All

Versions by product

Source: CISA KEV 2026.11.10, as of 10 Nov 2026; FIRST EPSS, as of 12 Nov 2026; CVE List, as of 12 Nov 2026. About the data.

Description

PAN-OS: Buffer Overflow Vulnerability in Protocol and Service Processing

A buffer overflow vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to disrupt service processing by causing a service process crash or memory corruption. Panorama and Prisma® Access are not affected by this vulnerability.

Source: CVE List, as of 12 Nov 2026. About the data.

What to do

Advisories and patches

• security.paloaltonetworks.com (Vendor advisory)

Solution (from the CVE record)

VERSION MINOR VERSION SUGGESTED SOLUTION Cloud NGFW Customers who prefer to upgrade can work with Palo Alto Networks support to schedule an on-demand software upgrade. PAN-OS 12.2 12.2.0 through 12.2.4-h* Upgrade to 12.2.4-h2 or later. PAN-OS 12.1 12.1.0 through 12.1.10-h* Upgrade to 12.1.10-h4 or later. PAN-OS 11.2 11.2.0 through 11.2.16-h* Upgrade to 11.2.16-h2 or later. PAN-OS 11.1 11.1.0 through 11.1.16-h* Upgrade to 11.1.16-h5 or later. All older Upgrade to a supported fixed version. unsupported PAN-OS versions Prisma Access No action needed.

Workaround (from the CVE record)

Customers can mitigate the risk of this issue by taking the following actions. Detach the SCTP Protection profile from active Security Policy rules allowing SCTP traffic. Disable configured DNS proxy objects: * Navigate to Network > DNS Proxy (https://docs.paloaltonetworks.com/ngfw/help/10-1/network/network-dns-proxy). * Click on each configured DNS Proxy object. * Uncheck the Enable checkbox. * Click OK and Commit the changes. Update any active OSPFv3 Auth Profiles under Network > Network Profiles > OSPFv3 Auth (https://docs.paloaltonetworks.com/ngfw/networking/advanced-routing/create-ospfv3-routing-profiles) to use standard cryptographic authentication other than ESP-NULL.

This summary is based on the CVE record as of 12 Nov 2026. Check the vendor's advisory before you act: affected versions and fixes can change.

Affected products and versions

Source: CVE List, as of 12 Nov 2026. About the data.

Timeline

Known exploited Palo Alto Networks vulnerabilities

• CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability (added 14 Oct 2026)
• CVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability (added 29 May 2026)
• CVE-2026-0300: Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability (added 6 May 2026)
• CVE-2025-0111: Palo Alto Networks PAN-OS File Read Vulnerability (added 20 Feb 2025)
• CVE-2025-0108: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability (added 18 Feb 2025)